← Vulnerability feed

Vulnerability record · CVE-2014-1643 · published 7 February 2014

CVE-2014-1643: Symantec encryption management server permissions and access controls vulnerability

Symantec · Encryption Management Server

The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.

4.0 CVSS 2.0 Medium EPSS 0.75% · top 47.0% CWE-264 · Permissions and access controls
4.0CVSS 2.0 base score
0.75%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
8References
17 Jun 2026Last modified by NVD

Description

The Web Email Protection component in Symantec Encryption Management Server (aka PGP Universal Server) before 3.3.2 allows remote authenticated users to read the stored outbound e-mail messages of arbitrary users via a modified URL.

AV:N/AC:L/Au:S/C:P/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/65300
http://www.securitytracker.com/id/1029729
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90946
http://www.securityfocus.com/bid/65300
http://www.securitytracker.com/id/1029729
http://www.symantec.com/security_response/securityupdates/detail.jsp?fid=security_advisory&pvid=security_advisory&year=& Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/90946

Track CVE-2014-1643 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.1CVE-2015-8151Symantec encryption management server os command injection vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote authenticated users to execute arbitrary OS commands by leveraging conso…EPSS 1.6%9.0CVE-2014-7288Symantec encryption management server permissions and access controls vulnerabilitySymantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allow remote authenticated administrators to execute arbitrary shell …EPSS 8.1%7.8CVE-2015-8150Symantec encryption management server permissions and access controls vulnerabilitySymantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows local users to obtain root access by modifying a batch file.EPSS 0.28%7.5CVE-2018-5243Symantec encryption management server uncontrolled resource consumption vulnerabilityThe Symantec Encryption Management Server (SEMS) product, prior to version 3.4.2 MP1, may be susceptible to a denial of service (DoS) exploit. A DoS …EPSS 1.8%7.5CVE-2015-8148Symantec encryption management server information exposure vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to obtain sensitive information about admi…EPSS 1.6%7.5CVE-2015-8149Symantec encryption management server memory buffer overflow vulnerabilityThe LDAP service in Symantec Encryption Management Server (SEMS) 3.3.2 before MP12 allows remote attackers to cause a denial of service (heap memory …EPSS 1.7%5.0CVE-2014-7287Symantec encryption management server injection vulnerabilityThe key-management component in Symantec PGP Universal Server and Encryption Management Server before 3.3.2 MP7 allows remote attackers to trigger un…EPSS 1.1%4.3CVE-2013-4674Symantec encryption management server cross-site scripting vulnerabilityCross-site scripting (XSS) vulnerability in the Web Email Protection component in Symantec Encryption Management Server (formerly Symantec PGP Univer…EPSS 0.89%

Source: NIST National Vulnerability Database (record CVE-2014-1643), CISA KEV, FIRST EPSS (scores of 2026-09-28). This page is refreshed as NVD updates the record.